What is claimed is: 

1. A method for diagnosing faults in a communication network using distributed 
alarm correlation, said method comprising: 

correlating alarm data at a first network node to produce local correlation results; and 
replicating diagnostic knowledge to a second network node, said diagnostic knowledge 
being obtained in response to said local correlation results. 

2. The method of claim 1 wherein said correlating alarm data comprises using a 
generic correlation algorithm to find a root cause of a fault in said network. 

3. The method of claim 1 wherein said correlating alarm data comprises using user- 
defined correlation rules to find a root cause of a fault in said network. 

4. The method of claim 1 wherein said diagnostic knowledge comprises a new 
correlation rule. 

5. The method of claim 1 wherein said diagnostic knowledge comprises at least one 
of a root cause, an alarm definition, and a corrective action. 

6. The method of claim 1 wherein said alarm data comprises alarm data generated 
by network elements in said communication network. 
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7. The method of claim 1 further comprising reporting said diagnostic knowledge 
and said local correlation results to a higher-level alarm correlation tool. 

8. The method of claim 1 wherein said correlating alarm data comprises correlating 
said alarm data using topology configuration information stored locally at said first network 
node. 

9. The method of claim 1 wherein said correlating alarm data comprises correlating 
said alarm data using a local knowledge base at said first network node, said local knowledge 
base including alarm definitions and correlation rules. 

10. A method for diagnosing faults in a communication network using distributed 
alarm correlation, said method comprising: 

receiving alarm data locally at network nodes in said communication network; 

correlating said alarm data locally at said network nodes using an associated node-level 
alarm correlation tool to produce correlation results at each of said network nodes; 

reporting said correlation results produced locally at said network nodes to respective 
users at respective said network nodes; 

adding diagnostic knowledge provided by at least one of said users to a local knowledge 
base at a respective at least one of said network nodes; 

replicating said diagnostic knowledge to other said network nodes; and 

reporting said diagnostic knowledge and said correlation results produced locally at said 
network nodes to a higher-level alarm correlation tool. 
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1 1 . The method of claim 10 further comprising: 

reporting said diagnostic knowledge to other said network nodes; and 

adding said diagnostic knowledge to a node knowledge base at said other said network 

nodes. 

12. The method of claim 10 further comprising: 

receiving said correlation results at said higher-level alarm correlation tool, said 
correlation results including root causes of faults determined by local alarm correlation at said 
network nodes; 

correlating said root causes determined at said network nodes to find a higher-level root 
cause at said higher-level alarm correlation tool; 

reporting said higher level root cause to a user of said higher-level alarm correlation tool; 

and 

adding higher-level diagnostic knowledge provided by said user at said higher-level 
alarm correlation tool to a higher-level knowledge base in said higher-level alarm correlation 
tool. 

13. The method of claim 10 further comprising receiving and storing local topology 
configuration information at respective said network nodes. 

14. A distributed alarm correlation system for diagnosing faults in a communication 
network, said distributed alarm correlation system comprising: 
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a plurality of node-level alarm correlation tools located at nodes in said communication 
network, wherein each of said node-level alarm correlation tools provide node-level alarm 
correlation to produce node-level correlation results and share diagnostic knowledge with other 
of said node-level alarm correlation tools at other nodes; and 

at least one higher-level management level alarm correlation tool located at a network 
management center in said communication network, wherein each of said node-level alarm 
correlation tools shares said diagnostic knowledge and said node-level correlation results with 
said higher-level management level alarm correlation tool, and wherein said higher-level 
management level alarm correlation tool provides higher-level alarm correlation to produce 
higher-level correlation results. 

15. The distributed alarm correlation system of claim 14 wherein each of said node- 
level alarm correlation tools comprises alarm definitions defining alarm groups categorizing 
alarms generated in said communication network. 

16. The distributed alarm correlation system of claim 15 wherein each of said node- 
level alarm correlation tools comprises correlation rules for determining a root cause in response 
to alarms received from network elements. 

17. The distributed alarm correlation system of claim 16 wherein each of said node- 
level alarm correlation tools comprises local topology configuration information. 
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1 8. The distributed alarm correlation system of claim 14 wherein each of said node- 
level alarm correlation tools includes a local knowledge base. 

19. The distributed alarm correlation system of claim 14 wherein each said higher- 
level alarm correlation tool includes a higher-level knowledge base. 

20. The distributed alarm correlation system of claim 14 wherein each of said node- 
level alarm correlation tools includes an alarm correlator for correlating network element alarm 
data with locally stored topology configuration information using user-defined correlation rules. 

21 . The distributed alarm correlation system of claim 14 wherein each of said node- 
level alarm correlation tools includes a knowledge replicator for replicating new diagnostic 
knowledge added by a user. 

22. The distributed alarm correlation system of claim 14 wherein each of said node- 
level alarm correlation tools allows new diagnostic knowledge to be accepted and added at the . 
discretion of a user. 

23. A distributed alarm correlation system for diagnosing faults in a communication 
network, said distributed alarm correlation system comprising: 

a plurality of node-level alarm correlators, located at nodes in said communication 
network, wherein each of said node-level alarm correlators provides node-level alarm correlation 
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to produce node-level correlation results and share diagnostic knowledge with other of said 
node-level alarm correlators; and 

at least one higher-level management level alarm correlator located at a network 
management center in said communication network, wherein each of said node-level alarm 
correlators shares said diagnostic knowledge and said node-level correlation results with said 
higher-level management level alarm correlator, and wherein said higher-level management level 
alarm correlator provides higher-level alarm correlation to produce higher-level correlation 
results. 

24. A machine-readable medium whose contents cause a computer system to perform a 
method of fault diagnosis in a communication network said method comprising: 

correlating alarm data at a first network node to produce local correlation results; and 

/ 

replicating diagnostic knowledge to a second network node, said diagnostic knowledge 
being obtained in response to said local correlation results. 

25. A machine-readable medium whose contents cause a computer system to perform 
a method of fault diagnosis in a communication network said method comprising: 

receiving alarm data locally at network nodes in said communication network; 

correlating said alarm data locally at said network nodes using an associated node-level 
alarm correlation tool to produce correlation results at each of said network nodes; 

reporting said correlation results produced locally at said network nodes to respective 
users at respective said network nodes; 
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adding diagnostic knowledge provided by at least one of said users to a local knowledge 

base at a respective at least one of said network nodes; 

replicating said diagnostic knowledge to other said network nodes; and 

reporting said diagnostic knowledge and said correlation results produced locally at said 

network nodes to a higher-level alarm correlation tool. 

26. The machine-readable medium of claim 24 wherein said method further 
comprises: 

receiving said diagnostic knowledge from said other network nodes; 

reporting said diagnostic knowledge received from said other network nodes to said user 
at said network node; and 

or adding said diagnostic knowledge received from said other network nodes to said 
knowledge base in response to said user. 
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